CORS (Cross-Origin Resource Sharing)

Adding the GAH scripts into your web page(s) sends a cross-origin HTTP request to the GAH signal-collector domain. For security reasons, browsers block cross-origin requests initiated from within scripts.

As a result, the POST and PATCH /signals request sent to GAH will be blocked. In order to enable this cross-origin request, GAH supports the CORS protocol:

• Before the POST or PATCH /signals request is made, the browser will first send an HTTP request (OPTIONS) to the GAH domain.

• The GAH backend processes this request and checks that it originates from an authorized domain (by looking at the Origin HTTP header), for example: www.your-domain.com. Altogether, this means that every domain issuing POST or PATCH /signals requests to the GAH must be declared in the product.

Note

If you are implementing a risk assessment on your login page, and this page is delegated to an identity provider, the domain name of the server hosting the identity provider should be provisioned in GAH.